I think the easiest solution would be to remove the tty10 destination from the default config altogether, which is maintained by the debian maintainers. In order to do that, please file a bug to the syslog-ng package. On Tue, Feb 16, 2021, 03:34 John Kristoff <jtk@dataplane.org> wrote:

I ran into the exact problem succinctly and completely written up here:

< https://www.claudiokuenzler.com/blog/988/syslog-ng-lxc-container-no-space-le...

...

It doesn't appear this was brought to the attention of the devs nor an issue even filed in github. I'd like to make sure I didn't miss something, so posting here for comment before I submit a github issue.

In summary, LXC sets up a small number of tty devices by default. However, syslog-ng in Debian has this config statement:

destination d_console_all { file(`tty10`); };

This results in syslog-ng writing the a new /dev/tty10 file instead of to a device, which will pretty quickly fill up an LXC /dev partition, causing syslog-ng to soon start failing when it sees the device associated with tty10 file handle full.

I have modified my syslog-ng.conf directly to use tty2 as the blog post suggested, but it would be nice if there was a "cleaner" work-around in the future.

John

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq